Privacy notice Website Without PHP (United Kingdom)
Version 1.2, 21 October 2026.
Website Without PHP is a service of Monkey Vision B.V.
This notice explains what personal data we handle through websitewithoutphp.com, why, how long we keep it and what rights you have under the UK GDPR and the Data Protection Act 2018.
1. Who we are
Website Without PHP is a service of Monkey Vision B.V. Monkey Vision B.V. is the controller for the processing described here.
Monkey Vision B.V. Bijleveldsingel 68c, 6524 AE Nijmegen, the Netherlands Dutch Chamber of Commerce (KvK) number 71714960 info@monkeyvision.nl, +31 24 202 2068
Monkey Vision B.V. has no establishment in the United Kingdom.
You can contact us about privacy at the address and number above.
2. When this notice applies
We help businesses with emergency recovery after PHP problems, PHP updates, migration, front-end rebuilds and maintenance. This notice covers data of people who visit our website, contact us, use the Exposure Check or ask for a quote or an engagement. Most of them are business contacts.
When we work on a client’s website, the client is responsible for the data of its own visitors and customers. We then act on the client’s instructions under a data processing agreement.
3. What data we use and why
| Purpose | Data | Lawful basis |
|---|---|---|
| Asking for a quote or urgent help through the form | Name, job title, company, email address, phone number, the domain and what you tell us about the problem | Steps at your request before entering a contract (Article 6(1)(b)) |
| Contacting us by email or phone | Your name, contact details and what you tell us | Our legitimate interest in answering your question (Article 6(1)(f)) |
| Quotes, engagements and invoices | Name, job title, company, contact details, quote and invoice data | Performing a contract (Article 6(1)(b)) and our legal duty to keep accounts (Article 6(1)(c)) |
| The free Exposure Check | The domain you enter and the result (180 days, without IP address) and your IP address (briefly, see section 4) | Our legitimate interest in running and protecting the tool (Article 6(1)(f)) |
| Sending you the Exposure Check report, when you ask for it | Your email address, the checked domain, the time and a reference to the check | Your request: you ask us for the report (performance of a contract, Article 6(1)(b)) |
| News about PHP security by email, only if you tick the separate box | Your email address | Your consent (Article 6(1)(a)) |
| Website security and faults | IP address, time, page requested, browser details in technical logs | Our legitimate interest in keeping the site secure and available (Article 6(1)(f)) |
| Visitor statistics with Cloudflare Web Analytics, only after Accept | Page viewed, referring site, load times, browser and device; your IP address only at Cloudflare | Your consent (Article 6(1)(a)) |
| Company recognition with Leadinfo, only after Accept | IP address, pages viewed, date and time, referring site and the cookies _li_id and _li_ses | Your consent (Article 6(1)(a)) |
What happens to your enquiry: we keep your enquiry for 14 days in Cloudflare (KV storage) and email it to two Monkey Vision staff members. After that it sits in an internal list (a spreadsheet in our office software) until the link with our quoting tool is in place. The retention period for leads in section 5 applies to that list. We use your IP address only briefly, to limit abuse (rate limit). We delete it after 10 minutes.
We do not make decisions about you that are taken only by a computer and that have a significant effect on you.
4. The Exposure Check
The Exposure Check tests whether a domain uses an outdated PHP version. We handle the domain you enter and your IP address. You do not need to log in.
We keep the domain you enter, the result and the time for 180 days, to see which sites we check and to improve the tool. We do not link this to you: we do not store your IP address with it. We use your IP address only briefly against abuse (10 minutes).
For the check we send one request to the homepage of the domain. We read the public headers and at most the first 32 KB of the HTML, only to recognise the platform (for example WordPress). We do not keep that HTML.
Your report by email
If you want the full report, we ask for your email address. We keep it for 90 days in Cloudflare (KV storage), together with the checked domain, the time and a reference to the check. We use it to send you the report and to link a later request through the form to the same check. The report itself contains no personal data about you; we keep it for 30 days so the link in the email keeps working.
You only get news by email if you tick the separate box for it. That box is never ticked in advance. We only send news after you confirm your email address through a confirmation email. You can withdraw your consent at any time, with the unsubscribe link in every email or through the address in section 11.
Protection against spam and bots
On our forms we use Cloudflare Turnstile to stop spam and abuse by bots. To do this, Turnstile processes technical data about your browser and device, such as your IP address and browser characteristics. We rely on our legitimate interest in keeping the forms secure. Turnstile is needed to submit the form you fill in, and is not used for statistics or marketing. Cloudflare processes this data under its own data processing terms.
5. How long we keep data
| Data | Retention |
|---|---|
| Enquiry through the form, in Cloudflare (KV storage) | 14 days |
| IP address against abuse (rate limit) | 10 minutes |
| Domain entered, result and time of the Exposure Check (without IP address) | 180 days |
| Email address for the Exposure Check report, with domain and time | 90 days |
| Exposure Check report (without email address) | 30 days |
| Email address for news, if you tick the box | Until you unsubscribe |
| Enquiries (leads) and quotes that were not accepted, also in the internal list | 1 year after the last contact |
| Client contact details | For as long as we work together, plus 2 years |
| Invoices and other tax records | 7 years, because the law requires it |
| Technical logs | At least 90 days and at most 12 months |
| Visitor statistics from Cloudflare Web Analytics, after Accept | We only see totals and receive no IP addresses |
| Leadinfo cookie _li_id, after Accept | 2 years, or shorter if you delete it yourself |
| Leadinfo cookie _li_ses, after Accept | Until the end of your visit |
| Visit data in Leadinfo, after Accept | 12 months after the visit |
| Your choice in the consent bar, in your browser | 12 months |
6. Who we share data with
We never sell your data. We share it only when our work needs it, and only with parties that handle it with care:
- Cloudflare, which hosts this website. Cloudflare provides the hosting, the network, the handling of the form, the protection against bots and the visitor statistics.
- Leadinfo B.V., for company recognition, only if you consent (see section 9). Leadinfo acts as our processor.
- Providers of email, of office software and of our quoting and customer records. We agree security and confidentiality terms with them.
- Our accountant.
- Staff and freelancers who work with us on an engagement, under confidentiality.
- Authorities, when the law requires us to.
Your enquiry goes by email to two Monkey Vision staff members. After that it sits in an internal list in our office software, until the link with our quoting tool is in place.
7. Data outside the UK
We are based in the Netherlands, so your data is handled in the European Economic Area. The UK treats the EEA as adequate for transfers from the UK. Leadinfo also handles its data in the EU.
Cloudflare is a US company. It is on the list of the EU-US Data Privacy Framework. For transfers from the UK to the US we rely on the UK Extension to that framework (the UK-US data bridge) or on standard contractual clauses with the UK addendum. Cloudflare states in its privacy policy that it complies with the UK Extension. You can ask us for an overview of the safeguards.
8. Security and access details
We protect your data with suitable measures, such as encrypted connections and access only for people who need it for their work. If something does go wrong with personal data, we follow our data breach procedure. We report it where we must, to the supervisory authority and to you.
Never send passwords or SSH access through the form or by email. We only ask for client access details through a secure vault.
9. Cookies, statistics and company recognition
Three services on this website do something in your browser:
- Cloudflare Turnstile on the forms, against spam and bots (see section 4). It is needed to submit the form.
- Cloudflare Web Analytics, for visitor statistics without cookies, only if you click Accept.
- Leadinfo, for company recognition, only if you click Accept in the bar at the bottom.
We use no other statistics or advertising services. If we add one, we will update this notice and, where required, ask for your consent first.
Visitor statistics with Cloudflare Web Analytics
We only use Cloudflare Web Analytics if you click Accept in the bar at the bottom. Cloudflare Web Analytics shows us how many pages are viewed, through which sites visitors arrive and how fast the pages load. It works without cookies, without storing anything in your browser and without following you across other sites. During your visit the script sends technical data to Cloudflare, such as the page viewed, the referring site, load times and your browser. Cloudflare also receives your IP address. We only see totals, we do not receive your IP address and we cannot recognise you. Cloudflare processes this data as our processor. The basis is your consent (Article 6(1)(a)), as the Privacy and Electronic Communications Regulations require.
Company recognition with Leadinfo, only with your consent
If you click Accept in the bar at the bottom, we load Leadinfo, from Leadinfo B.V. in the Netherlands. Leadinfo looks at the IP address of your visit and finds the company that belongs to that business IP address. We then see which company visited our site, which pages were viewed, when, and through which site. Leadinfo recognises companies, not people. If you are a sole trader, the company name can still say something about you.
To do this, Leadinfo sets two of its own cookies on our site: _li_id, which recognises a returning visitor (2 years), and _li_ses, which records which pages you view during this visit (only for the visit). The script also uses temporary storage in your browser to hold data until it has been sent.
The basis is your consent. If you refuse, we do not load Leadinfo and the site works exactly the same. Leadinfo acts as our processor, under a data processing agreement, and handles the data in the EU. The IP address is compared with Leadinfo’s own company database; Leadinfo itself is responsible for that database. You can read how Leadinfo handles it in the privacy statement on leadinfo.com.
Changing your choice
We keep your choice for 12 months in your browser (localStorage, under the name wwp-consent-v1). This only remembers your choice, so it needs no consent. After 12 months we ask again. You can change your choice or withdraw your consent at any time through Cookie settings at the bottom of every page. If you withdraw your consent, we no longer load Leadinfo. Leadinfo cookies already on your device can be deleted in your browser.
10. Chat and AI
There is no chat and no AI feature on this website. If that changes, we will update this notice.
11. Your rights
You have the right to:
- access your data;
- have inaccurate data corrected;
- have your data erased;
- have the use of your data restricted;
- receive your data in a common format or have it transferred;
- object to use of your data based on our legitimate interest;
- withdraw your consent, for everything we asked consent for.
Send your request to info@monkeyvision.nl. We answer within one month. Sometimes we ask you to prove who you are, so that we do not give data to the wrong person.
If you are not happy with how we handle your data, please tell us first. You can also complain to the Information Commissioner’s Office (ICO) in the United Kingdom (ico.org.uk).
12. Changes
We change this notice when our way of working changes. The date at the top shows which version applies.
Need help with your PHP site? Request help.